Linking a Yandex Cloud Backup policy to a VM automatically using the management console, CLI, or API

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

1. View the description of the CLI command to activate the service:

   yc backup provider activate --help
   

2. Activate the service in the default folder:

   yc backup provider activate --async
   

   Where --async displays the operation progress info. This is an optional parameter.

   Result:

   id: cdgmnefxiatx********
   description: activate provider
   created_at: "2024-10-14T09:03:47.960564Z"
   created_by: ajec1gaqcmtr********
   modified_at: "2024-10-14T09:03:47.960564Z"
   done: true
   metadata:
     '@type': type.googleapis.com/yandex.cloud.backup.v1.ActivateProviderMetadata
     folder_id: b1go3el0d8fs********
   response:
     '@type': type.googleapis.com/google.protobuf.Empty
     value: {}
   

After activation, the system automatically creates the following backup policies:

• Default daily: Daily incremental backup with the last 15 backups retained.
• Default weekly: Weekly incremental backup with the last 15 backups retained.
• Default monthly: Monthly incremental backup with the last 15 backups retained.

If you prefer not to create them, use the --skip-default-policy parameter.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

1. Create a service account named backup-sa:

   yc iam service-account create --name backup-sa
   

   Result:

   id: ajehb3tcdfa1********
   folder_id: b1g86q4m5vej********
   created_at: "2024-07-22T16:05:14.237381531Z"
   name: backup-sa
   

   For more information about the yc iam service-account create command, see the CLI reference.

2. Assign the backup.editor role for the folder to the service account:

   yc resource-manager folder add-access-binding <folder_ID> \
     --role backup.editor \
     --subject serviceAccount:<service_account_ID>
   

   Result:

   done (3s)
   effective_deltas:
     - action: ADD
       access_binding:
         role_id: backup.editor
         subject:
           id: ajehb3tcdfa1********
           type: serviceAccount
   

   For more information about the yc resource-manager folder add-access-binding command, see the CLI reference.

To create a service account, use the create REST API method for the ServiceAccount resource or the ServiceAccountService/Create gRPC API call.

To assign the backup.editor role for the folder to the service account, use the setAccessBindings method for the ServiceAccount resource or the ServiceAccountService/SetAccessBindings gRPC API call.

1. Create a cloud network named cloud-network:

   yc vpc network create cloud-network
   

   Result:

   id: enptrcle5q3d********
   folder_id: b1g9hv2loamq********
   created_at: "2024-06-08T09:25:03Z"
   name: cloud-network
   default_security_group_id: enpbsnnop4ak********
   

   For more information about the yc vpc network create command, see the CLI reference.

2. Create a subnet named cloud-network-ru-central1-d in the ru-central1-d availability zone:

   yc vpc subnet create cloud-network-ru-central1-d \
     --zone ru-central1-d \
     --network-name cloud-network \
     --range 10.1.0.0/16
   

   Result:

   id: e9bnnssj8sc8********
   folder_id: b1g9hv2loamq********
   created_at: "2024-06-08T09:27:00Z"
   name: cloud-network-ru-central1-d
   network_id: enptrcle5q3d********
   zone_id: ru-central1-d
   v4_cidr_blocks:
   - 10.1.0.0/16
   

   For more information about the yc vpc subnet create command, see the CLI reference.

1. Create a network named cloud-network using the create REST API method for the Network resource or the NetworkService/Create gRPC API call.
2. Create the cloud-network-ru-central1-d subnet using the create REST API method for the Subnet resource or the SubnetService/Create gRPC API call.

Run the following command:

yc vpc security-group create backup-sg \
  --network-name network-1 \
  --rule "direction=egress,port=80,protocol=tcp,v4-cidrs=[213.180.193.0/24]" \
  --rule "direction=egress,port=80,protocol=tcp,v4-cidrs=[213.180.204.0/24]" \
  --rule "direction=egress,port=443,protocol=tcp,v4-cidrs=[84.47.172.0/24]" \
  --rule "direction=egress,port=443,protocol=tcp,v4-cidrs=[84.201.181.0/24]" \
  --rule "direction=egress,port=443,protocol=tcp,v4-cidrs=[178.176.128.0/24]" \
  --rule "direction=egress,port=443,protocol=tcp,v4-cidrs=[213.180.193.0/24]" \
  --rule "direction=egress,port=443,protocol=tcp,v4-cidrs=[213.180.204.0/24]" \
  --rule "direction=egress,from-port=7770,to-port=7800,protocol=tcp,v4-cidrs=[84.47.172.0/24]" \
  --rule "direction=egress,port=8443,protocol=tcp,v4-cidrs=[84.47.172.0/24]" \
  --rule "direction=egress,port=44445,protocol=tcp,v4-cidrs=[51.250.1.0/24]" \
  --rule "direction=ingress,port=22,protocol=any,v4-cidrs=[0.0.0.0/0]"

Result:

id: enp0v73fe8fs********
folder_id: b1g86q4m5vej********
created_at: "2024-07-22T20:17:43Z"
name: backup-sgg
network_id: enp3srbi9u49********
status: ACTIVE
rules:
- id: enpporsovuhj********
    direction: EGRESS
    ports:
      from_port: "80"
      to_port: "80"
    protocol_name: TCP
    protocol_number: "6"
    cidr_blocks:
      v4_cidr_blocks:
        - 213.180.193.0/24
- id: enp7p6asol5i********
    direction: EGRESS
    ports:
      from_port: "80"
      to_port: "80"
    protocol_name: TCP
    protocol_number: "6"
    cidr_blocks:
      v4_cidr_blocks:
        - 213.180.204.0/24
...
- id: enp36mip5nhe********
    direction: INGRESS
    ports:
      from_port: "22"
      to_port: "22"
    protocol_name: ANY
    protocol_number: "-1"
    cidr_blocks:
      v4_cidr_blocks:
        - 0.0.0.0/0

For more information about the yc vpc security-group create command, see the CLI reference.

To create a security group, use the create REST API method for the SecurityGroup resource or the SecurityGroupService/Create gRPC API call.

1. Describe the configuration of the backup policy you are creating in the backup-policy-scheme.json file.

   {
     "compression": "NORMAL",
     "format": "AUTO",
     "multiVolumeSnapshottingEnabled": true,
     "preserveFileSecuritySettings": true,
     "reattempts": {
       "enabled": true,
       "interval": {
         "type": "SECONDS",
         "count": "30"
       },
       "maxAttempts": "30"
     },
     "silentModeEnabled": true,
     "splitting": {
       "size": "1099511627776"
     },
     "vmSnapshotReattempts": {
       "enabled": true,
       "interval": {
         "type": "MINUTES",
         "count": "5"
       },
       "maxAttempts": "3"
     },
     "vss": {
       "enabled": true,
       "provider": "TARGET_SYSTEM_DEFINED"
     },
     "archive": {
       "name": "'[Machine Name]-[Plan ID]-[Unique ID]A'"
     },
     "performanceWindow": {
       "enabled": true
     },
     "scheduling": {
       "backupSets": [
         {
           "time": {
             "weekdays": [
               "FRIDAY"
             ],
             "repeatAt": [
               {
                 "hour": "3"
               }
             ],
             "type": "WEEKLY"
           }
         }
       ],
       "enabled": true,
       "maxParallelBackups": "2",
       "randMaxDelay": {
         "type": "MINUTES",
         "count": "30"
       },
       "scheme": "ALWAYS_INCREMENTAL",
       "weeklyBackupDay": "MONDAY"
     },
     "cbt": "ENABLE_AND_USE",
     "fastBackupEnabled": true,
     "quiesceSnapshottingEnabled": true
   }
   

2. Create a backup policy:

   yc backup policy create \
     --name weekly-backup \
     --settings-from-file ./backup-policy-scheme.json
   

   Result:

   id: cdgo5vytuw57********
   name: weekly-backup
   created_at: "2024-07-23T20:34:37Z"
   updated_at: "2024-07-23T20:34:37Z"
   enabled: true
   settings:
     compression: NORMAL
     format: AUTO
     multi_volume_snapshotting_enabled: true
     preserve_file_security_settings: true
     reattempts:
       enabled: true
       interval:
         type: SECONDS
         count: "30"
       max_attempts: "30"
     silent_mode_enabled: true
     splitting:
       size: "1099511627776"
     vm_snapshot_reattempts:
       enabled: true
       interval:
         type: MINUTES
         count: "5"
       max_attempts: "3"
     vss:
       enabled: true
       provider: TARGET_SYSTEM_DEFINED
     archive:
       name: '''[Machine Name]-[Plan ID]-[Unique ID]A'''
     performance_window:
       enabled: true
     retention: {}
     scheduling:
       backup_sets:
         - time:
             weekdays:
               - FRIDAY
             repeat_at:
               - hour: "3"
             type: WEEKLY
           type: TYPE_AUTO
       enabled: true
       max_parallel_backups: "2"
       rand_max_delay:
         type: MINUTES
         count: "30"
       scheme: ALWAYS_INCREMENTAL
       weekly_backup_day: MONDAY
     cbt: ENABLE_AND_USE
     fast_backup_enabled: true
     quiesce_snapshotting_enabled: true
   folder_id: b1g86q4m5vej********
   

   Save the policy id.

   For more information about the yc backup policy create command, see the CLI reference.

To create a backup policy, use the create REST API method for the Policy resource or the PolicyService/Create gRPC API call.

1. Describe the custom metadata configuration in the user-data.yaml file:

   #cloud-config
   datasource:
     Ec2:
     strict_id: false
   ssh_pwauth: no
   users:
   - name: vm-user
     sudo: ALL=(ALL) NOPASSWD:ALL
     shell: /bin/bash
     ssh_authorized_keys:
     - <public_SSH_key>
   packages:
     - curl
     - perl
     - jq
   runcmd:
     - curl https://storage.yandexcloud.net/backup-distributions/agent_installer.sh | sudo bash
   

2. Specify the weekly-backup policy ID in the cloudbackup.json file:

   {"initialPolicies": ["<weekly_backup_policy_ID>"]}
   

   To learn more about getting the policy ID, see Getting information about a backup policy.

3. Run this command:

   yc compute instance create \
     --name backup-instance \
     --zone ru-central1-d \
     --network-interface subnet-name=cloud-network-ru-central1-d,security-group-ids=<backup-sg_security_group_ID>,ipv4-address=auto,nat-ip-version=ipv4 \
     --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-2204-lts,size=15 \
     --metadata-from-file user-data=./user-data.yaml,cloudbackup=./cloudbackup.json \
     --service-account-name backup-sa
   

   For more information about the yc compute instance create command, see the CLI reference.

To create a VM, use the create REST API method for the Instance resource or the InstanceService/Create gRPC API call.

In the request body, specify:

• In the metadata field, the user-data object containing the custom metadata configuration with a script to install a backup agent.
• In the cloudbackup field, the backup policy ID. To learn more about getting the policy ID, see Getting information about a backup policy.

Use \n as a line separator.

{
  "folderId": "<folder_ID>",
  "name": "backup-instance",
  "zoneId": "ru-central1-d",
  "platformId": "standard-v3",
  "resourcesSpec": {
    "memory": "2147483648",
    "cores": "2"
  },
  "metadata": {
    "user-data": "#cloud-config\ndatasource:\nEc2:\n  strict_id: false\nssh_pwauth: no\nusers:\n- name: vm-user\n  shell: /bin/bash\n  sudo: ALL=(ALL) NOPASSWD:ALL\n  ssh_authorized_keys:\n  - <public_SSH_key>\npackages:\n  - curl\n  - perl\n  - jq\nruncmd:\n  - curl https://storage.yandexcloud.net/backup-distributions/agent_installer.sh | sudo bash",
    "cloudbackup": "{\"initialPolicies\": [\"<policy_ID>\"]}"
  },
  "bootDiskSpec": {
    "diskSpec": {
      "size": "16106127360",
      "imageId": "fd8ljvsrm3l1********"
    }
  },
  "networkInterfaceSpecs": [
    {
      "subnetId": "<subnet_ID>",
      "primaryV4AddressSpec": {
        "oneToOneNatSpec": {
          "ipVersion": "IPV4"
        }
      },
      "securityGroupIds": [
        "<security_group_ID>"
      ]
    }
  ],
  "serviceAccountId": "<service_account_ID>"
}